http Request [Errno -3] Temporary failure in name resolution

[sunnyvi]

Self Checks

• I have read the Contributing Guide and Language Policy.
• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
• Please do not modify this template :) and fill in all the required fields.

Dify version

1.16.1

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

After I upgraded from version 1.13.0 to 1.16.1, the HTTP requests in the original workflow threw errors. [Errno -3] Temporary failure in name resolution

I have modified the. env file and added the required content to it.

The IP I requested belongs to a computer on my local area network. It worked fine on version 1.13.0, but this error occurs after the upgrade.

✔️ Expected Behavior

Able to send HTTP requests normally, thank you

❌ Actual Behavior

No response

[dosubot]

Hi @sunnyvi! I'm Dosu and I'm helping the Dify team.

This is caused by the SSRF proxy deny-by-default policy introduced in Dify 1.15.0 [1]. When you upgraded from 1.13.0 to 1.16.1, the Squid SSRF proxy started blocking all private/RFC-1918 IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, etc.) by default — only .marketplace.dify.ai is whitelisted out of the box [2]. Since your target is a LAN IP, the proxy blocks the request, which surfaces as the [Errno -3] Temporary failure in name resolution error.

Fix: Add the appropriate exceptions to your .env file [3]:

# Allow a specific IP or subnet
SSRF_PROXY_ALLOW_PRIVATE_IPS=192.168.1.0/24

# If you're targeting by hostname instead
SSRF_PROXY_ALLOW_PRIVATE_DOMAINS=your-hostname

Replace the IP/subnet with your actual LAN address range. Then do a full restart so the entrypoint script regenerates the Squid ACL config from the new .env values [4]:

docker compose down
docker compose up -d

I can see from your screenshot that you've already added some .env entries. Double-check that you're using the exact variable names above (SSRF_PROXY_ALLOW_PRIVATE_IPS / SSRF_PROXY_ALLOW_PRIVATE_DOMAINS) and that you ran a full down/up cycle rather than just a restart. This same fix has been confirmed working by other users who hit this after upgrading to 1.15.0+ [5].

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.